2026 UEN Tech Summit

macOS ships with a powerful set of built-in security tools — but many admins never go beyond the basics. This session dives into macOS's built-in security utilities often overlooked by admins, giving you the practical knowledge to better protect the Macs in your organization. Learn how to leverage native macOS tools to diagnose security issues, audit system configurations, manage security settings, and automate security-related tasks.

TDIR stands for Threat Detection, Investigation, and Response. It is a comprehensive security approach that helps organizations assess risks, understand security incidents, and remediate threats quickly. TDIR capabilities enable security teams to detect threats, investigate incidents, and respond effectively to minimize impact. This term is an industry term that is being discussed across K12s and higher education. We will discuss the future of threat detection and how education can take advantage of these frameworks.

The SOC of the Future is envisioned as a resilient, AI-augmented security operations center that continuously monitors, detects, investigates, and responds to cybersecurity threats in real time. It leverages advanced technologies such as AI-powered threat detection, extended detection and response (XDR), and enhanced visibility across endpoints, IoT, and networks. Key capabilities include AI-driven threat detection and monitoring, AI-augmented incident triage and investigation, proactive threat hunting with AI hypotheses, AI-enriched threat intelligence, and automated incident response and remediation. The modern SOC integrates federated data management and analytics, enabling comprehensive asset visibility and risk mitigation while simplifying security operations through AI-assisted workflows. It unifies threat detection, investigation, and response (TDIR) workflows within a single platform, improving operational efficiency and reducing alert fatigue by up to 90% with risk-based alerting. The SOC of the Future also emphasizes collaboration across teams and tools, leveraging integrations with Cisco and third-party security products to protect the entire digital footprint. Automation and orchestration accelerate response times, with AI-guided investigations reducing case management time by 83% and enabling near-zero time to recovery from incidents such as ransomware attacks. The SOC continuously evolves through AI feedback loops and detection engineering, supported by comprehensive threat intelligence and compliance monitoring frameworks. Overall, the SOC of the Future combines human expertise with AI and automation to deliver faster, more accurate threat detection and response, ensuring digital resilience and reducing business risk in an increasingly complex threat landscape

I passed the Certified Information Systems Security Professional (CISSP) exam in 2025. This presentation would be for anyone who may be interested in the exam and learning how I went about preparing for it.

For the past 2 years, I have been presenting information regarding IPv6. Things to think about when deploying it, planning for it, and looking at detailed configs like SLAAC vs DHCPv6. This is mostly to help bring awareness to the community. This year, my final IPv6 presentation will be specifically about security. I will be going over some of the security risks that can be exploited in IPv6 and how to mitigate them. IPv6 is still new and unfamiliar to many. This is intended to make people aware of the security considerations to make before deploying IPv6.

We will discuss the importance of securing and validating prefix/subnet announcements using the RPKI infrastructure and the ROA. This discussion will review how they work, why they matter, and how to implement them.

Internet routing protocols were designed with a weak security posture, creating vulnerable attack vectors via route hijacking. We’ll break down how RPKI works at a practical level, including certificate hierarchy, ROA creation, and route validation states (valid, invalid, not found). We’ll walk through real-world examples of route leaks and hijacks, showing how RPKI can prevent or mitigate these events. Attendees will leave with a clear understanding of how to implement RPKI/ROA in their environment and immediately improve routing security.